Getting Data In

How to map data from raw logs to key/value pairs to be searched in Splunk?

Path Finder

I have splunk forwarder setup to forward cloudfront logs on S3, say following is the example of raw logs:

2015-01-15  20:59:36    LHR50   334 90.201.16.203   GET zfu.cloudfront.net

Can someone give me an example how to map them to key=value pairs? so I can query them in splunk

0 Karma

Builder

I suggest using the field extractor. If you are running 6.2.x this feature has improved greatly. Have a look here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ExtractfieldsinteractivelywithIFX

You can extract fields using props/transoforms but for simple extractions the Interactive Field Extractor works great.

0 Karma

Path Finder

Thanks for the reply, I was trying to do it as how explained below

http://docs.splunk.com/Documentation/AddOns/released/CiscoWSA/Configurew3clogfieldextractions

Cloudfront format is as following

Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent) cs-uri-query cs(Cookie) x-edge-result-type x-edge-request-id x-host-header cs-protocol cs-bytes time-taken

I tried steps mentioned in link above but still doesn't work, do I need to change prop.conf for this?

0 Karma

Splunk Employee
Splunk Employee
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!